CVE-2026-101996: Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured

Published Oct 14, 2026

Updated

A Reachable Assertion vulnerability in the

l2ald

daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message.

Affected Software

2 affected components

Juniper Networks Junos OS

Juniper Networks Junos OS Evolved

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.11
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.6
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.2R2-S6
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.4R2-S5
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2R2-S2
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R1-S3
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R2
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R2
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.4R1
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.13
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.5
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 24.2R2-S6
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 24.4R2-S5
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 25.2R2-S2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R1-S3
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R1-S2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 26.4R1

Event History

Oct 14, 2026

CVE Published

via MITRE·04:30 PM

Data Sourced

via MITRE·04:30 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Junos OS and Junos OS Evolved devices are affected when they are configured for MC-LAG/ICCP. The attack vector is adjacent-network access rather than remote access over the internet.

What does an attacker need to exploit it?

An attacker needs to be adjacent to the affected device and able to send an inconsistent ICCP peer message. No privileges or user interaction are required.

What is the impact of successful exploitation?

Successful exploitation can crash the l2ald daemon, resulting in a denial of service. The provided severity vector indicates no confidentiality or integrity impact.